Title: [201571] trunk/Source/WebCore
- Revision
- 201571
- Author
- [email protected]
- Date
- 2016-06-01 14:43:09 -0700 (Wed, 01 Jun 2016)
Log Message
Crash under eventTargetRespectingTargetRules()
https://bugs.webkit.org/show_bug.cgi?id=158273
<rdar://problem/26343998>
Reviewed by Alex Christensen.
The code would call nodeOrHostIfPseudoElement(), which can return null
and then dereference it in eventTargetRespectingTargetRules() without
null check. This patch adds a null check. When the node is null, the
while loop after will do nothing and thus the target will not be used.
No new tests, we do not have a good reproduction case.
* dom/EventPath.cpp:
(WebCore::EventPath::EventPath):
Modified Paths
Diff
Modified: trunk/Source/WebCore/ChangeLog (201570 => 201571)
--- trunk/Source/WebCore/ChangeLog 2016-06-01 21:40:16 UTC (rev 201570)
+++ trunk/Source/WebCore/ChangeLog 2016-06-01 21:43:09 UTC (rev 201571)
@@ -1,3 +1,21 @@
+2016-06-01 Chris Dumez <[email protected]>
+
+ Crash under eventTargetRespectingTargetRules()
+ https://bugs.webkit.org/show_bug.cgi?id=158273
+ <rdar://problem/26343998>
+
+ Reviewed by Alex Christensen.
+
+ The code would call nodeOrHostIfPseudoElement(), which can return null
+ and then dereference it in eventTargetRespectingTargetRules() without
+ null check. This patch adds a null check. When the node is null, the
+ while loop after will do nothing and thus the target will not be used.
+
+ No new tests, we do not have a good reproduction case.
+
+ * dom/EventPath.cpp:
+ (WebCore::EventPath::EventPath):
+
2016-06-01 Commit Queue <[email protected]>
Unreviewed, rolling out r201551 and r201552.
Modified: trunk/Source/WebCore/dom/EventPath.cpp (201570 => 201571)
--- trunk/Source/WebCore/dom/EventPath.cpp 2016-06-01 21:40:16 UTC (rev 201570)
+++ trunk/Source/WebCore/dom/EventPath.cpp 2016-06-01 21:43:09 UTC (rev 201571)
@@ -91,7 +91,7 @@
bool isTouchEvent = event.isTouchEvent();
#endif
Node* node = nodeOrHostIfPseudoElement(&originalTarget);
- Node* target = eventTargetRespectingTargetRules(*node);
+ Node* target = node ? eventTargetRespectingTargetRules(*node) : nullptr;
while (node) {
while (node) {
EventTarget* currentTarget = eventTargetRespectingTargetRules(*node);
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
